open-redirect

Detects and exploits open redirect vulnerabilities through parameter analysis, filter bypass, and exploit chaining.

Updated Jun 5, 2026

Search Tags:#oauth #penetration testing #web security #url validation #ssrf #open redirect #filter bypass

Ready to run

npx skills add https://github.com/lNwNl/Praxis --skill open-redirect-lnwnl

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: open-redirect
Source: https://github.com/lNwNl/Praxis/tree/main/skills/_disabled/open-redirect
Command: npx skills add https://github.com/lNwNl/Praxis --skill open-redirect-lnwnl

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web applications often redirect users based on unvalidated URL parameters, letting attackers abuse trusted domains for phishing, OAuth token theft, and SSRF. This Skill provides a structured playbook for finding, bypassing, and chaining open redirect vulnerabilities during authorized penetration tests and CTF challenges. ## Core Features & Use Cases - Redirect Discovery: Enumerates common redirect parameters (url, next, return, callback) and identifies server-side and JavaScript navigation sinks. - Filter Bypass Techniques: Covers protocol-relative URLs, userinfo confusion, backslash tricks, double encoding, CRLF injection, and URL parser differentials between validators and browsers. - Exploit Chaining: Documents escalation paths from open redirect to phishing amplification, OAuth/OIDC token theft, CSRF Referer bypass, tabnabbing, and SSRF via redirect-following fetchers. - Use Case: During a web CTF or authorized pentest, you find /redirect?url= on a target. Use this playbook to test //evil.com, [email protected], and /\evil.com variants, then chain a confirmed redirect into an OAuth implicit-flow token theft scenario. ## Quick Start Ask the agent to test the target's redirect parameters for open redirect vulnerabilities and attempt filter bypass payloads from the playbook.

Frequently Asked Questions about open-redirect

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for open redirect vulnerabilities?▼

Open redirect testing starts by finding URL parameters like url, next, redirect, return, or callback that control navigation. Submit an external domain such as ?url=https://evil.com and check whether the application issues a 301/302 or JavaScript redirect to it without validation.

How to bypass open redirect URL validation filters?▼

Common bypasses include protocol-relative URLs (//evil.com), userinfo confusion ([email protected]), backslash tricks (/\evil.com), and double URL encoding. The right bypass depends on whether the validator checks prefixes, suffixes, or substring matches against an allowlist.

Can an open redirect lead to OAuth token theft?▼

Yes, when an OAuth redirect_uri allows an open redirect on the authorized domain, tokens or authorization codes can leak to an attacker URL. In implicit flow the access_token in the URL fragment is forwarded to the attacker's page after the redirect fires.

What is reverse tabnabbing and how does it work?▼

Reverse tabnabbing occurs when a link with target="_blank" lacks rel="noopener", letting the opened page access window.opener and redirect the original tab to a phishing page. Users returning to the original tab see a fake login and may enter credentials.

Why do URL parser differentials enable redirect bypass?▼

Validators and browsers parse URLs differently, so a payload like //evil.com\@trusted.com may pass an allowlist check while the browser navigates to evil.com. Exploiting these parsing gaps in userinfo, fragments, backslashes, and encoded characters defeats string-based validation.